topic Re: TACACS authentication over the VPN tunnel - How To? in Network Access Control

TACACS authentication over the VPN tunnel - How To?

evguenipesliak — Sun, 10 Mar 2019 22:50:00 GMT

Hi all,

There are multiple examples on how to setup TACACS autentication/authorization on the PIXs, but they all seem to use local ACS (on the inside interface of the PIX). What if we have ACS on a remote site and have to send AAA requests across the VPN tunnel? Is this supported by Cisco? Should I still use: "aaa-server TACACS (inside)..." or is it considered to be on an outside interface? Any examples out there? Same question for the ASA appliance (8.0(3)).

THank you,

Evgueni

Re: TACACS authentication over the VPN tunnel - How To?

smahbub — Wed, 14 May 2008 15:08:51 GMT

Authentication determines who the user is and authorization determines what the user can do. Before you configure the security appliance to use an external server, you must configure the server with the correct security appliance authorization attributes and, from a subset of these attributes, assign specific permissions to individual users.

Refer the following urls for the configuration guide and example on authentication/authorization configs:

http://www.cisco.com/en/US/docs/security/asa/asa81/config/guide/extsvr.html

For more info on "aaa srever TACACS" COMMAND refer:

http://www.cisco.com/en/US/docs/security/pix/pix63/command/reference/ab.html#wp1070086

Re: TACACS authentication over the VPN tunnel - How To?

evguenipesliak — Fri, 16 May 2008 15:02:40 GMT

Thank you for the reply, Smahbub

However the question was about one particular scenario, when the ACS server (TACACS+) is on the opposite side of the VPN tunnel. How do I configure the ASA in that case? Is it supported by Cisco? I do not want to send AAA traffic over Internet, but via the VPN... Do I use (inside) or (outside) command in that case?

Regards,

Evgueni

Re: TACACS authentication over the VPN tunnel - How To?

mike.keller — Sat, 17 May 2008 00:28:34 GMT

I dont think this can be done, I have been trying to accomplish the same thing on both 7.x ASA code and 8.x ASA code. I have opened a TAC and was told this isnt possible. I have also asked the question to our Cisco Advanced Services Team and other that I know that work for Cisco, including 2 CCIE route/switch and a CCIE security. I also want to send dhcp requests back across the VPN tunnel and this is also not possible. I have to run the dhcp server on the ASA, which makes it more difficult to administer.

Re: TACACS authentication over the VPN tunnel - How To?

mike.keller — Tue, 20 May 2008 00:14:52 GMT

I have confirmed that this is a bug in the 8.x code train. It was suggested to me to use 7.2(4) code, which I will be installing and testing tomorrow. If it works, I will post the proper syntax to source the AAA from the inside interface across the VPN tunnel.

Re: TACACS authentication over the VPN tunnel - How To?

evguenipesliak — Tue, 20 May 2008 12:10:04 GMT

Thank you so much, Mike

Would appreciate greatly if you could share your findings with us.

Re: TACACS authentication over the VPN tunnel - How To?

alibowluk — Thu, 29 May 2008 10:09:42 GMT

Hi there,

i'm currently encountering this exact same issue. I'm running 8.0(3) code, and can't get the remote end to talk to out ACS Server, even though a ping sourced from the inside interface works. Seems silly this setup is possible between an ASA and a router but not an ASA to ASA setup. I'm intrigued to know your findings.

i'm waiting with bated breath 🙂

Ali

Re: TACACS authentication over the VPN tunnel - How To?

richardburford — Wed, 11 Jun 2008 09:00:35 GMT

Did you ever get this working? I am encountering exactly the same issue with 8.0(3) code.

Our 7.2 ASA's work fine with exactly the same config.

Is there a bug reference for this issue?

Re: TACACS authentication over the VPN tunnel - How To?

jeff_groesbeck — Thu, 04 Sep 2008 18:57:40 GMT

Hello. I'd be curious to know if anyone has tried this with 8.0(4) and if it is fixed. I am having this problem as well and have used RADIUS as a workaround in the meantime. I can't perform command authorization this way, but I do get authentication and it works fine.

Thank you,

Jeff

Re: TACACS authentication over the VPN tunnel - How To?

evguenipesliak — Thu, 04 Sep 2008 19:02:23 GMT

Hi Jeff,

Can you share your RADIUS setup? Which interface you use - inside or outside? Surprised to hear that it works for RADIUS - thought it does not work for both.

Thanks,

Evgueni

Re: TACACS authentication over the VPN tunnel - How To?

jeff_groesbeck — Thu, 04 Sep 2008 19:12:59 GMT

Hello Evgueni,

The configuration I'm using is on an ASA with 8.0(3) code. Basically, the AAA setup is the same as it always is (of course, RADIUS in this case because TACACS doesn't work) and I am using the 'inside' interface as the source interface. I am also using the management-access inside command to make sure that it will communicate using the inside address over the tunnel. I'm pretty sure this command has to be there for this to work (at least I think it used to be).

I have this working on an ASA right now and it works fine. Authentication only.

Thanks,

Jeff

Re: TACACS authentication over the VPN tunnel - How To?

jeff_groesbeck — Fri, 05 Sep 2008 16:15:27 GMT

Hello again.

I opened a case on this issue to see if it was resolved in 8.0(4). This issue regarding TACACS over a VPN tunnel has a bug ID (CSCsk08454) and is resolved in 8.0(4). I have not tested this yet, but it is in the release notes as well. I also looked the bug up and found a workaround as well. I have not tried this either, but it is listed in the bug tracker. Apparently if you enable reverse route injection for the L2L tunnel, tacacs will work successfully. Again, I haven't tested this, but it's in the notes.

Thank you,

Jeff

Re: TACACS authentication over the VPN tunnel - How To?

richardburford — Mon, 08 Sep 2008 07:23:49 GMT

I had this exact problem with 8.0(3). I upgraded to 8.0(4) reloaded and logged straight in using TACACS.

8.0(4) should completely resolve this issue for you

Re: TACACS authentication over the VPN tunnel - How To?

jeff_groesbeck — Mon, 08 Sep 2008 12:34:58 GMT

Thank you. I hadn't had a chance to test this yet.

Re: TACACS authentication over the VPN tunnel - How To?

mike.keller — Thu, 13 Nov 2008 18:00:54 GMT

This has been resolved with 8.0(4). In order to use it here is the syntax:

aaa-server SOMENAMEHERE protocol tacacs+

aaa-server SOMENAMEHERE (INTERFACE) host x.x.x.x key xxxxxxxxxx

I have personally verified that this works on 8.0(4)

Re: TACACS authentication over the VPN tunnel - How To?

grimish.patel — Tue, 18 Jan 2011 19:53:38 GMT

Hi,

Have a ASA 5510 running 8.2(4) code. I have a site-to-site VPN of which this ASA is the remote end. I'm trying to tunnel NTP, and Authentication traffic through the VPN tunnel but SSH in the the clear so both traffic types terminate and originate from the outside interfaces. The authentication method is TACACS at the moment and I've specified the outside interface for this.

So far I can't seem to get this working; any ideas?

Re: TACACS authentication over the VPN tunnel - How To?

grimish.patel — Sat, 29 Sep 2012 15:49:46 GMT

Update - got this working, by simply upgrading to v8.2(5). One thing left. How do I authenticate from a standby ASA acrossing the active VPN (I can't see how this is done, unless somehow the inside interfaces are used)

Re: TACACS authentication over the VPN tunnel - How To?

Terence Lockette — Wed, 27 Feb 2019 16:15:41 GMT

Mike,

I know this is a very old forum but I am having this same issue. However, I was able to get DHCP to work across the tunnel so local clients can pull DHCP across the tunnel. This only worked when I created an SVI for the VLAN in question and added the 'ip helper-address' command. I also had to make sure I was using a more specific network object instead of an all subnets object (0.0.0.0/0) for NAT exemption and the ACL for tunnel traffic. Once this was done, I was able to pull DHCP from the main DC.